27-04-2008, 20:25
|
|
|
( ) ..:
SmitFraudFix v2.319
Scan done at 21:21:16.17, Sun 04/27/2008
Run from C:\Documents and Settings\Administrator\My Documents\AntiVirus\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\gsicon.exe
C:\WINDOWS\system32\dslagent.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
C:\Program Files\Winamp Remote\bin\Orb.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\cmd.exe
hosts
C:\
C:\WINDOWS
C:\WINDOWS\system
C:\WINDOWS\Web
C:\WINDOWS\system32
C:\WINDOWS\system32\LogFiles
C:\Documents and Settings\Administrator
C:\Documents and Settings\Administrator\Application Data
Start Menu
C:\DOCUME~1\ADMINI~1\FAVORI~1
Desktop
C:\Program Files
C:\Program Files\tmp???????.exe FOUND !
Corrupted keys
Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="about:Home"
"SubscribedURL"="about:Home"
"FriendlyName"="ƒ“ „‰ „…‹‡‰ ™‰"
IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
[!] Suspicious: zip.dll
SSODL: zip - {09d6fdbb-20c8-4227-875b-cfafdec55d89}
404Fix
!!!Attention, following keys are not inevitably infected!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""
Rustock
DNS
Description: WAN (PPP/SLIP) Interface
DNS Server Search Order: 62.219.186.7
DNS Server Search Order: 192.117.235.235
HKLM\SYSTEM\CCS\Services\Tcpip\..\{2A3FA507-7B2E-4A36-8E7E-95DA03FE2312}: NameServer=62.219.186.7 192.117.235.235
HKLM\SYSTEM\CS1\Services\Tcpip\..\{2A3FA507-7B2E-4A36-8E7E-95DA03FE2312}: NameServer=62.219.186.7 192.117.235.235
HKLM\SYSTEM\CS2\Services\Tcpip\..\{2A3FA507-7B2E-4A36-8E7E-95DA03FE2312}: NameServer=192.117.235.235 62.219.186.7
Scanning for wininet.dll infection
End
...
|
'
) Kaspersky Anti-Virus 7.0 , 
